i just noticed that the html tags attributes values are not escaped but outputted on the browser as-is. it also is better to enclose them in double quotes instead than single, because for some reasons the escaping of the single quote does not work very well.
i think escaping with htmlentities should be enough. for example in markups.php, function BOLTMlinks, line 432, in place of: $attr .= " $f='$v' "; it should be: $attr .= " $f=\"" . htmlentities($v, ENT_COMPAT, 'UTF-8') . "\" "; the same goes for: function BOLTMstyles, line 554 function BOLTMtables, line 589 function BOLTMuploads, line 648 and 671 maybe there also other places where the above apply. blues --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "BoltWire" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [EMAIL PROTECTED] For more options, visit this group at http://groups.google.com/group/boltwire?hl=en -~----------~----~----~----~------~----~------~--~---
